Make request deadline extensions reach the socket behind the logging middleware

Long agent turns were cut at exactly 30s on the live instance with "The
connection dropped partway through." — the #78 failure, which its tests
said was fixed. The tests host openEventStream on a bare gin.New(); in
production, slog-gin replaces c.Writer with a wrapper that embeds the
gin.ResponseWriter interface, which has no Unwrap, so the ResponseController
built from the handler's writer can't reach the connection and every
SetWriteDeadline returns ErrNotSupported. The stream fell back to the
server's absolute WriteTimeout; the first write past it failed, cancelled
the request context, and closed the socket under the client mid-frame.
The scan upload's read/write extensions failed the same way, with the
errors discarded.

captureController now runs first on the engine and stashes a controller
built before anything wraps the writer; openEventStream and scanSeedPacket
take it from responseController(c). The regression tests run the stream
through New() — the real stack, in the real order — and check from the
client side; the scan path logs once instead of swallowing the error.

Co-Authored-By: Claude Fable 5 <[email protected]>

internal/api/agent.go

@@ -164,11 +164,16 @@ type eventStream struct {
 // write path. Only the client sees it, as a truncated stream it reports as a
 // dropped connection. Hence a deadline set up front and refreshed per frame,
 // rather than anything checked after the fact.
+//
+// The controller comes from responseController, NOT from c.Writer: by the time
+// a handler runs, the logging middleware has wrapped the writer in something a
+// controller can't unwrap, and every deadline call fails — which is how this
+// fix shipped, tested, and stayed broken live (see deadlines.go).
 func openEventStream(c *gin.Context) *eventStream {
 	c.Header("Content-Type", "text/event-stream")
 	c.Header("Cache-Control", "no-cache")
 	c.Header("X-Accel-Buffering", "no")
-	s := &eventStream{c: c, rc: http.NewResponseController(c.Writer)}
+	s := &eventStream{c: c, rc: responseController(c)}
 	// Probe once here rather than reporting per frame: a writer that can't take
 	// deadlines will fail identically on every write, and the operator needs to
 	// hear it once. If this fails the stream still works — it is just back to